Add bounty board filtering/sorting/pagination and validate avatar image URLs

[Godbrand0]

Summary

closes #28 and
closes #20 .

#28 — bounty board pagination/filtering/sorting

• New src/lib/bounty-query.ts: parses status/difficulty/asset/minReward/maxReward/sort/page from searchParams, with every value degrading to a sane default instead of erroring (unrecognized enum, non-numeric or out-of-range page, inverted reward range, out-of-range page number all clamp/degrade gracefully).
• /issues reads and renders these from the URL (Server Component searchParams, no client state), so every filter/sort/page combination is a shareable, bookmarkable link. Difficulty/asset/reward-range/sort are a plain <form method="get"> so the page works with JS disabled; the status pills stay <Link>s.
• filterBounties/applyBountyQuery run against whatever fetchBounties returns — live or mock fallback — so the mock-data path has full filter/sort/pagination parity with live data by construction, with no separate mock-only logic to keep in sync.
• fetchBounties now forwards the query as backend query params via buildBountyQueryString. The backend doesn't currently honor them (confirmed: /bounties returns the full unfiltered collection regardless), so the client-side pass above is still the source of truth — this is forward-compatible with server-side filtering landing later without needing another frontend change.
• Empty state distinguishes "your filter matches nothing" from "the platform has nothing" (already existed for status; now covers all facets).

#20 — avatar URL validation

• Avatar.tsx now rejects any src that isn't an https: URL on the same host allowlist as next.config.ts's images.remotePatterns (avatars.githubusercontent.com, api.dicebear.com) before it reaches next/image — blocks javascript:/data: schemes and any unexpected third-party host, falling back to the dicebear identicon.
• Also falls back on a genuine load failure (404/unreachable) via onError, tracking the specific failed src so it doesn't retry the same failing URL in a loop but does retry if the prop later changes to a different URL.

Test plan

• npx jest — all suites pass except 3 pre-existing failures unrelated to this change (timezone-dependent locale.test.ts, and CallbackClient.test.tsx failures present on main before this branch)
• New tests: src/lib/bounty-query.test.ts (parsing, filtering, sorting, pagination, href-building) and expanded src/components/ui/Avatar.test.tsx (allowlisted host, non-allowlisted host, javascript:/data: schemes, load-failure fallback)
• npx eslint clean on all changed files
• npx tsc --noEmit — no new errors (pre-existing unrelated errors confirmed present on main)

[vercel]

@Godbrand0 is attempting to deploy a commit to the chonilius' projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@Godbrand0 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits